feat(tests): add unit tests for validation functions in docker-contai…

[Siumauricio]

…ner-logs

• Introduced tests for isValidTail, isValidSince, isValidSearch, and isValidContainerId functions to ensure proper validation and security against command injection.
• Updated docker-container-logs to utilize these validation functions, enhancing input handling for WebSocket connections.

What is this PR about?

Please describe in a short paragraph what this PR is about.

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

Screenshots (if applicable)

Greptile Summary

Added validation functions and unit tests for docker container log parameters (tail, since, search, containerId) to prevent command injection attacks. However, the isValidSearch regex still allows critical shell metacharacters ($, `, ', (), and these parameters are directly embedded in shell commands executed via SSH and locally.

Critical security issues:

• isValidSearch allows $, `, ', and ( which enable command substitution
• Line 99 uses double quotes where $(cmd) and `cmd` execute
• Line 153 uses single quotes where ' can break out of quoting
• Test comment incorrectly claims search is not concatenated into shell commands

Other findings:

• Good: isValidTail, isValidSince, and isValidContainerId validations are strong
• Good: Comprehensive test coverage for non-search parameters
• Good: Default values prevent null/undefined injection

Confidence Score: 0/5

• This PR introduces a critical remote code execution vulnerability
• The isValidSearch function allows shell metacharacters ($, `, ', () that enable command injection. These are directly exploitable in the SSH path (line 99, double quotes) and local path (line 153, single quotes) where user input is embedded in shell commands. An attacker can execute arbitrary commands by sending malicious search parameters.
• Critical attention needed: apps/dokploy/server/wss/utils.ts and apps/dokploy/server/wss/docker-container-logs.ts contain exploitable command injection vulnerabilities

_{Last reviewed commit: 33c3a4e}

[greptile-apps]

_{3 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Additional Comments (2)

apps/dokploy/server/wss/docker-container-logs.ts
Shell injection vulnerability: single quotes can contain special chars that break out. The local execution path uses single quotes around ${search} but doesn't escape it, while the SSH path (line 99) properly escapes with double quotes. An attacker could inject commands using: ' ; whoami ; '

				const escapedSearch = search ? search.replace(/'/g, "'\\''") : "";
				const command = search
					? `${baseCommand} 2>&1 | grep -iF '${escapedSearch}'`
					: baseCommand;

---

apps/dokploy/server/wss/docker-container-logs.ts
Shell injection risk: double quotes don't fully protect against command substitution. A search string like $(whoami) or `whoami` will still execute. The -F flag helps but the validation should prevent backticks and $() entirely, or use single quotes with proper escaping (like line 153 should do).

						const command = search
							? `${baseCommand} 2>&1 | grep --line-buffered -iF '${escapedSearch.replace(/'/g, "'\\''")}'`
							: baseCommand;

[Siumauricio]

@greptile review

[greptile-apps]

_{3 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Critical: allows $, `, ', and ( which enable command injection. Since search is inserted into shell commands (line 99 uses double quotes where $ and ` execute; line 153 uses single quotes where ' breaks out), this creates a remote code execution vulnerability.

Suggested change

	export const isValidSearch = (search: string): boolean => {
	return /^[\x20-\x21\x23-\x25\x27-\x28\x2A-\x3A\x3D\x3F-\x5B\x5D-\x7B\x7D-\x7E]{0,500}$/.test(
	search,
	);
	export const isValidSearch = (search: string): boolean => {
	return /^[a-zA-Z0-9\s._-]{0,500}$/.test(search);
	};

[greptile-apps]

Additional Comments (1)

apps/dokploy/server/wss/docker-container-logs.ts
Command injection via $ and ` in double quotes. Even with single-quote escaping, ${escapedSearch} in double quotes allows $(whoami) or `whoami` execution.

				const escapedSearch = search ? search.replace(/'/g, "'\\''") : "";
				const command = search
					? `${baseCommand} 2>&1 | grep --line-buffered -iF '${escapedSearch}'`
					: baseCommand;